1

I'm trying to set up an integration on Magento 2.4.4 but this is not working. The other side are reporting this error coming from Magento:

"Signature method HMAC-SHA1 is not supported"

Other integrations are working fine but I can't find any kind of logging on my end.

How can I debug this this to find out what the issue is?

From what I understand HMAC-SHA1 is supported by Magento https://devdocs.magento.com/guides/v2.4/get-started/authentication/gs-authentication-oauth.html

1
  • Have you tried simulating the requests in something like Postman?
    – Hunter
    Commented May 13, 2022 at 16:58

1 Answer 1

1

I had the same issue with Community Edition 2.4.4.

According to the \Magento\Framework\Oauth\OauthInterface constants, SHA1 has been deprecated. By using HMAC-SHA256 I could get past the signature error.

     * Signature Methods
     */
    /**
     * @deprecated SHA1 is deprecated
     * @see SIGNATURE_SHA256
     */
    const SIGNATURE_SHA1 = 'HMAC-SHA1';

    const SIGNATURE_SHA256 = 'HMAC-SHA256';
2
  • For now I just re-enabled HMAC-SHA1. Obviously SHA1 has to go sometime but too many people still use it and I understood that it was still just about sufficient for HMAC? Commented Jun 1, 2022 at 10:30
  • Unfortunately the documentation wasn't updated in line with the source code. The best I can offer is a Magento issue on GitHub, hopefully the ticket discussion can shed some light - github.com/magento/magento2/issues/35510 Commented Jun 2, 2022 at 12:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.